7.1
Élevée
CVE-2026-90555 vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing…
Description
vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypass duration checks. Attackers can submit forged FLAC headers with inflated sample rates to trigger excessive memory allocation and crash the API server process affecting all tenants.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| vllm 0.28 | premières → < 0.28.0 | 0.28.0 |
Références
- GitHub Security Advisory (GHSA-99f2-hwrc-gvq8) github.com
- VulnCheck Advisory: vLLM before 0.28.0 Denial of Service via Audio Header www.vulncheck.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de vllm
Les 121 CVE de vllm →
CVE-2026-115918
vLLM is an inference and serving engine for large language models
6.5
Moyenne
CVE-2026-115917
vLLM is an inference and serving engine for large language models
3.4
Faible
CVE-2026-115916
vLLM is an inference and serving engine for large language models
6.5
Moyenne
CVE-2026-115915
vLLM is an inference and serving engine for large language models
8.1
Élevée